How to communicate with affected users or clients?

Timeliness: notify quickly when users may have been affected. Delayed notification allows damage to spread. Balance thoroughness against urgency.

Clarity: explain what happened, what risk users face, and what actions they should take. Avoid technical jargon that obscures meaning. Specific guidance is better than vague warnings.

Channels: use trusted communication paths recipients will recognize. Email about email compromise is problematic; consider alternative channels for initial notification. Follow up with detailed written guidance.